
package de.unihannover.se.restlab.microblog.resources;

import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.ws.rs.Consumes;
import javax.ws.rs.FormParam;
import javax.ws.rs.GET;
import javax.ws.rs.HeaderParam;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.UriInfo;

import de.unihannover.se.restlab.microblog.data.AccountStorage;
import de.unihannover.se.restlab.microblog.data.AuthService;
import de.unihannover.se.restlab.microblog.data.UserStorage;
import de.unihannover.se.restlab.microblog.models.Account;
import de.unihannover.se.restlab.microblog.models.Link;
import de.unihannover.se.restlab.microblog.models.Role;

@Path("accounts")
public class AccountListRessource {

	// @Context SecurityContext securityContext; //@Sec.Context funktioniert nur nach
	// Änderungen/Ergänzungen in der web.xml; Nutzer und Rollen dadurch extern
	// festgelegt
	@Context
	HttpServletRequest request;
	@Context
	UriInfo ui;
	@GET
	@Produces({MediaType.TEXT_PLAIN, MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON})
	public Response list (@HeaderParam("Authorization") String authHeader) {

		List<Account> accounts = AccountStorage.getStorage().getAccounts();
		for (Account account : accounts) {
			Link self = new Link(ui.getAbsolutePathBuilder().path("{id}").build(account.getAccountId()).toString(), "self");
			account.setSelf(self);
		}

		//String authHeader = request.getHeader("Authorization");
		
		if (authHeader == null) { // Authorizaiton-Header angegeben?
			return Response.status(401).header("www-Authenticate", "Basic realm=\"Account-Liste: Authorization required\"").build();
		} else if (!(AuthService.isUserAuthenticated(request))) { // User und Passwort korrekt?
			return Response.status(401).header("www-Authenticate", "Basic realm=\"Account-Liste: User or Password incorrect\"")
				.build();
		} else {
			return Response.ok(accounts.toArray(new Account[] {})).build();
		}
	}

	@POST
	@Produces({MediaType.TEXT_PLAIN, MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON})
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	public Response create (@FormParam("username") String name, @FormParam("role") String role,
		@FormParam("password") String password, @HeaderParam("Authorization") String authHeader) {

		//String authHeader = request.getHeader("Authorization");
		
		if (authHeader == null) { // Auhtorizaiton-Header angegeben?
			return Response.status(401).header("www-Authenticate", "Basic realm=\"Account-Liste: Auhtorization required\"").build();
		} else if (!(AuthService.isUserAuthenticatedAndAdmin(request))) { // User und Passwort korrekt und Rolle = Admin?
			return Response.status(401).header("www-Authenticate", "Basic realm=\"Account-Liste: User or Password incorrect\"")
				.build();
		} else {
			Account account = AccountStorage.getStorage().createAccount(UserStorage.getStorage().createUser(name), Role.valueOf(role), password);
			return Response.ok(account).build();
		}

	}

	// Subressource über AccountID oder über Username? Theoretisch beides
	// möglich.
	@Path("{accountID}")
	public AccountRessource getAccountRessource (@PathParam("accountID") Integer id, @Context HttpServletRequest request) {
		return new AccountRessource(id, request);
	}

}
